RENA Polska Sp. z.o.o. takes the protection of personal data very seriously. We want you to know which data we store, and when and how we use it. We are subject to the provisions of the European General Data Protection Regulation (GDPR) and the supplementary provisions of the German Bundesdatenschutzgesetz (Federal Data Protection Act, BDSG). We have taken appropriate technical and organisational measures to ensure that both our external service providers and we comply with data protection regulations.

This data protection information applies to our online offers. This includes websites, functions and content as well as external online presences, such as our appearances on social media. This general data protection information also serves to inform you about the further processing of your personal data and to fulfil our obligation to inform you.

The terms used in this data protection information, such as controller or personal data, are used in accordance with the definitions of the GDPR. For reasons of readability and thus also for the purposes of comprehensibly transferring information, the naming of individual articles, paragraphs or the like is usually omitted.

 

Controller

The controller – within the meaning of the GDPR and other national data protection laws – of the Member States as well as other provisions of data protection law is:

RENA Polska Sp. z.o.o.

Wykroty ul. Wyzwolenia 30
Poland 59 -730 Nowogrodziec

Controllers and Managing Directors Thomas Meier, Karsten Robel, Rafał Cybulski.

Tel: +48 75 64 93 100

E-mail: info@rena.com

 

Data protection officer

The controller has appointed a data protection officer. You can reach our data protection officer at datenschutz@rena.com

If you have any questions, suggestions or comments regarding data protection and the enforcement of your rights listed below, please contact our data protection officer:

 

General information on data processing

Scope of the processing of personal data

We process your personal data in principle only to the extent that this is necessary to provide a functioning Internet presence as well as our content and services. The processing of your personal data takes place regularly only after your consent.

An exception applies in those cases in which prior consent cannot be obtained for reasons of fact or law and the processing of the data is permitted by statutory regulations.

 

Legal basis for the processing of personal data

Within the scope of data protection regulations, the processing of personal data is in principle not permitted, unless there is a legally admissible reason for permission. We are obliged to inform you about the legal basis of data processing.

Insofar as we obtain your consent for processing personal data, this serves as a legal basis.

When processing personal data that is required for the fulfilment of a contract to which you are a party, the fulfilment of the contract serves as a legal basis. This shall also apply to processing operations necessary for the implementation of pre-contractual measures.

If the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, this serves as a legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, this serves as a legal basis.

If the processing is necessary to protect a legitimate interest of our company or a third party and these interests, your fundamental rights and freedoms are not overridden by the first interest, then this serves as a legal basis for the processing.

 

Children

Our offer is in principle aimed at adults. Persons under the age of 16 may not transmit any personal data to us without the consent of their parents or legal guardians.

Erasure of data and duration of storage

As soon as the purpose for storage no longer applies, we will erase or block your personal data. Beyond this period, however, storage may take place if this is necessary due to legal regulations to which we are subject. This applies, for example, to data that must be stored for reasons of commercial or tax law, such as delivery notes or invoice data.

Your data will be blocked or erased when a storage period prescribed by these regulations expires, unless it is necessary for further storage of the data for the conclusion or fulfilment of a contract.

 

Disclosure of personal data to third parties

In principle, we do not pass on any personal data to third parties without your express consent. If we nevertheless disclose your data to third parties within the scope of processing, transfer them to third parties, or grant them access to the data, this will also be done exclusively on the basis of one of the aforementioned legal bases.

For example, we transmit data to payment service providers or suppliers if this is necessary for the fulfilment of the contract. If we are obliged by law or court order to do so, we must transfer your data to the relevant authorities entitled to receive such information.

In some cases, we use carefully selected external service providers to process your data. Should data be passed on to service providers within the scope of so-called commissioned data processing, this is done on the basis of the GDPR specifications. Our contract processors are carefully selected, bound by our instructions and checked at regular intervals. We only commission such contract processors who offer sufficient safeguards that suitable technical and organisational measures will be taken in such a way that the processing is in accordance with the requirements of the GDPR and BDSG and guarantees the protection of your rights.

 

Transfer of data to third countries

The GDPR guarantees an equally high level of data protection within the European Union. When selecting our service providers and cooperation partners, we therefore rely as far as possible on European partners if your personal data is to be processed. Only in exceptional cases will we have your data processed outside the European Union within the scope of the use of third-party services.

We only allow your data to be processed in a third country if the specific requirements of the GDPR are fulfilled. This means that your data may only be processed on the basis of specific safeguards. These safeguards include the official recognition by the EU Commission of a level of data protection equivalent to that of the EU, the respect of officially recognised specific contractual obligations (the so-called standard contractual clauses) or other agreements between the EU and third countries (such as the Privacy Shield, an agreement between the EU and the US).

 

Existence of automated decision making

We waive automatic decision making or profiling.

 

Rights of the data subject

If your personal data are processed, then you are a data subject within the meaning of the GDPR. You are entitled to the rights listed below.

To exercise these rights, please contact our data protection officer.

 

Right to withdraw consent

If the processing of your personal data is based on consent given by you, you have the right to withdraw this consent at any time. The withdrawal shall not affect the lawfulness of the processing carried out up to that point.

 

Right of access

You have the right to request confirmation from us as to whether we are processing personal data concerning you. If this is the case, you can request information about the following information:

• The processing purposes;
• The categories of personal data processed;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed;
• The planned duration for which the personal data will be stored or, if this is not possible, criteria for determining the duration;
• The existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by us or a right to object to such processing;
• The existence of a right of appeal to a supervisory authority;
• If the personal data is not collected from you, all available information about the origin of your data;
• The existence of automated decision-making, including profiling, and, at least in these cases, meaningful information about the logic involved as well as the implications and intended effects of such processing for you.

You have the right to request information as to whether your personal data will be transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards in connection with the transfer

Within one month of receiving your request for information, we will provide you with a copy of the personal data that is the subject of the processing. If you submit the application electronically, we will provide you with the information in a common electronic format, unless you indicate otherwise.

 

Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate personal data. Taking into account the purposes of processing, you shall have the right to incomplete personal data completed.

 

Right to erasure (“right to be forgotten”)

You have the right to request that we erase any personal information about you immediately and we are obligated to erase any personal information immediately if any of the following reasons apply:

• Personal data are no longer needed for their original processing purpose for which they were processed;
• You withdraw your consent on which the processing was based and there is no other legal basis for processing;
• You object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing;
• The processing of the personal data was done processed unlawfully;
• The erasure of personal data is required to fulfil a statutory obligation under Union or Member State law.
• The personal data were collected in relation to information society services offered.
• If we have made the personal data concerning you public and we are obliged to delete it, we shall take reasonable measures – including technical measures – to inform the data controllers processing the personal data that you have requested them to delete all links to this personal data or copies or replications of this personal data, taking into account the available technology and implementation costs.

Right to erasure (“right to be forgotten”) does not exist, insofar as processing is necessary:

• For the exercise of freedom of expression and information;
• To fulfil any legal obligation to which we are subject, or to perform any task in the public interest or in the exercise of official authority vested in us;
• On grounds of public interest in the field of public health;
• For archival, scientific or historical research purposes in the public interest or for statistical purposes where the right to erasure is likely to make it impossible or seriously prejudicial to the attainment of the objectives of such processing, or;
• For the assertion, exercise or defence of legal claims.

 

Right to restriction of processing

You have the right to demand that we restrict the processing of your personal data if one of the following conditions is met:

• You dispute the accuracy of the personal data concerning you for a duration that allows us to verify the accuracy of the personal data;
• The processing is unlawful and you demand the restriction of the use of the personal data instead of the erasure;
• We no longer need the personal data for the purposes of processing, but you do need it to assert, exercise or defend legal claims, or;
• You have lodged an objection against the processing as long as it is not yet certain whether our justified reasons outweigh your reasons.
• If processing has been restricted in accordance with the above conditions, such personal data shall not be processed, except for their storage, without your consent or for the purpose of asserting, exercising or defending a right or protecting the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State.

If the restriction on processing has been restricted in accordance with the above requirements, we will notify you before the restriction is lifted.

 

Right to data portability

You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without our hindrance, provided that the processing is based on consent or a contract and is carried out using automated procedures.

By exercising your right to data portability, you can have your personal data transferred directly from us to another controller, as far as this is technically feasible. The exercise of the right to data portability does not affect the right to erasure (“right to be forgotten”). This right shall not apply to processing which is necessary for the performance of a task assigned to us in the public interest or in the exercise of official authority.

 

Right to object

You have the right, for reasons arising from your specific situation, to object at any time to the processing of your personal data on the basis of a weighing of interests. This also applies to profiling based on these provisions. We will then no longer process the personal data unless we can prove compelling reasons for the processing worthy of protection which outweigh your interests, rights and freedoms or the processing serves the assertion, exercise or defence of legal claims.

If personal data are processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling in so far as it is connected with such direct marketing. If you object to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

In connection with the use of information society services, you may exercise your right to object by means of automated procedures using technical specifications.

 

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or similarly significantly affects you. This does not apply if the decision:

• Is necessary for entering into, or performance of, a contract between you and us,
• Iis authorised by Union or Member State law to which we are subject and such laws contain reasonable measures to safeguard your rights and freedoms and your legitimate interests; or
• Is based on your explicit consent.

We will implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain intervention on the part of the controller, to express their point of view and to contest the decision.

 

Right of complaint to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of complaint to a supervisory body, including but not limited to the Member State in which you reside, your place of work or the location of the alleged infringement, if you believe that the processing of your personal data is in breach of the GDPR.

 

Use of our online offer

In principle, you can use our online offer without disclosing your identity. In this section we explain to you when and in what context we process data when using our online services, which services we have implemented by service providers and cooperation partners, how these work and what happens to your data

 

Data collection when visiting our websites

If you only use our websites for information purposes, i.e. if you do not register for an offer, conclude a contract with us or otherwise disclose information to us, we only collect personal data transmitted by your browser to our servers.

When you visit our websites, we collect the following data, which is technically necessary for us to be able to display our websites to you and to guarantee stability and security:

• IP address of the visitor
• Date and time of the request
• Contents of the request (concrete page)
• Access status/HTTP status code
• amount of data transferred in each case
• Website from which the request originates
• Visitor's operating system
• Language and version of the browser software.

This data is temporarily stored in the log files of our system for a maximum duration of seven days. Storage beyond this is possible, but in this case, the IP addresses will be shortened or alienated so that it is no longer possible to assign the calling client. The log files are not stored together with other personal data relating to you in this context. The legal basis for these processing operations is our legitimate interest.

Since the collection of data for the display of the websites and the storage of data in log files is absolutely necessary for the operation of our websites and the maintenance of IT security, you have no right of objection in this respect.

 

Use of cookies

General information on the use of cookies

In addition to the aforementioned data, cookies are stored on your terminal device when you visit our websites. Cookies are small text packages that can be sent from a website to the browser and stored by the browser and sent back again. Cookies can be used to store various data that can be read by the location that sets the cookie. They usually contain a characteristic character string (ID) that enables the browser to be uniquely identified when the website is called up again or a page is changed. Their primary purpose is to make our online offerings more user-friendly and effective overall. The user data collected in cookies are pseudonymised by technical precautions, which means that it is generally no longer possible to assign the data to the calling user. As far as an identifiability is given, as for example with a Login Cookie, whose session ID is necessarily linked with the account of the user, we point it out to you at the appropriate place.

We use different types of cookies:

• So-called “session cookies” are cookies that are erased after you leave our website and close your browser. Such cookies are used, for example, to store language settings or the contents of a shopping basket.
• “Permanent cookies” remain stored even after closing the browser. For example, the login status or entered search terms can be saved. We use such cookies among other things for range measurement or marketing purposes. Persistent cookies are automatically erased after a specified period, which may vary depending on the cookie. However, you can delete these cookies at any time with the help of your browser.

In addition to so-called “first party cookies”, which we set as the data controller, we also use so-called “third party cookies”, which are offered by other providers.

• As the controller , we set so-called “first party cookies”:

the legal basis for the processing of your personal data is our legitimate interest.

• External service providers who carry out web tracking or range measurements for us, for example, can also set cookies.

the legal basis for the processing of your personal data is your consent.

 

Please note:

A general objection to the use of cookies for advertising purposes can be raised for a variety of services via the EU website https://www.youronlinechoices.com/de/ or the US website https://www.aboutads.info/choices/  . In addition, you can configure your browser settings to accept third party cookies, refuse all cookies, or activate the “Do Not Track” option. However, you may no longer be able to use all the functions of our online services.

Information on special cookies

Google Analytics

If you have given your consent, this website uses Google Analytics, a web analysis service provided by Google LLC, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This makes it possible to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus analyse the activities of a user across devices.

By being certified under the EU-US Privacy Shield, Google guarantees that the EU's data protection requirements will also be met when processing data in the United States.

Google Analytics uses cookies to help the website analyse how users use the site. The information generated by the cookie about your use of this website will generally be transmitted to and stored by Google on servers in the United States. However, if IP anonymisation is enabled on this website, Google will previously truncate your IP address within Member States of the European Union or other signatory states to the Agreement on the European Economic Area. We would like to point out that on this website Google Analytics has been extended to include IP anonymisation in order to guarantee anonymous collection of IP addresses. The IP address transmitted by your browser as part of Google Analytics is not combined with other data from Google.

• Frequency of page views
• Number of users
• Jump rate (page is closed again after a page call)
• Session duration (average duration of all users)
• Country from which the website was accessed
• Use of website functions
• Which page is selected and how often
• Which website the user is coming from
• Which region the user is coming from
• The device and device category with which the user accesses our website

On our behalf, Google will use this information to evaluate your use of the website, to compile reports on the activities on our site and to provide us with other services associated with the use

The legal basis for the use of Google Analytics is your voluntary consent.

You can find more information on Google's terms of use and data protection here and here.

 

Recipients / Categories of recipients

The recipient of the collected data is Google

 

Transfer to third countries

The personal data is transferred to the USA under the EU-US Privacy Shield on the basis of an adequacy decision of the European Commission. You can view the corresponding certificate here .

 

Duration of data storage

The data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs are automatically erased after 14 months. The erasure of data whose retention period has been reached is carried out automatically once a month.

You can also prevent Google from collecting the data generated by the cookie and related to your use of the website and Google from processing this data by downloading and installing the browser add-on to deactivate Google Analytics for your browser.

A so-called opt-out cookie prevents the future collection of your data when you visit this website. However, to prevent capture across different devices, you must opt-out on all the devices you use. If you click here , the opt-out cookie will be set for your currently used device.

 

Google Maps

We use Google Maps to display our location. This is a service of Google LLC, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as Google). The IP address must be processed by Google in order for the map to be displayed.

By being certified under the EU-US Privacy Shield, Google guarantees that the EU's data protection requirements will also be met when processing data in the United States.

The cooperation with Google in terms of data protection law is based on a concluded agreement on joint responsibility according to Art. 26 GDPR, which is available here .

In all other respects, you enter into a usage relationship with Google directly as a result of the use of Google Maps.

For more information on Google's terms of use and privacy policy, please click here.

 

Recipients / Categories of recipients

The recipient of the collected data is Google

 

Transfer to third countries

The personal data is transferred to the USA under the EU-US Privacy Shield on the basis of an adequacy decision of the European Commission. You can view the corresponding certificate here .

 

Duration of data storage

The data sent by us will be erased automatically after 14 months. The erasure of data whose retention period has been reached is carried out automatically once a month.

 

Inquiries to us

If you send us an inquiry - for example if you send us an e-mail - your personal data will be processed for the following purposes:

• Processing your request submitted in the contact form
• Processing your service request
• Processing your return delivery
• Telephone and written (e-mail) enquiries
• Information about products and services

Your data will not be used by us for automated decision making or profiling.

 

Job applications

Within the scope of a job application to us, the data you provide - such as your contact data and qualifications - will be used exclusively for the processing of the application process.

Your data will be passed on internally to the department manager controller. We process your personal data for the purpose of your application for employment to the extent necessary to decide whether an employment relationship should be entered into.

Furthermore, we may process personal data about you to the extent necessary to defend ourselves against legal claims asserted against us in the application process.

Your data will in principle be erased three months after completion of the application process, unless otherwise agreed with the applicant (see “Admission to the Applicant Pool”). If your application is followed by the conclusion of an employment contract, the data is included in the personnel file.

 

How long is your data stored?

We store your personal data for as long as is necessary to make a decision about your application. If an employment relationship between yourself and us is not established, we may also further store data to the extent necessary to defend against possible legal claims. The application documents are erased two months after notification of the rejection decision, unless longer storage is necessary due to legal disputes.

 

Amendments

This data protection information will be updated periodically. These updates are made, for example, if amendments occur as a result of technical progress, statutory requirements or other influences on our part.

As of: May 2019